Who is responsible
RMErecruit, trading from 558 Upper Newtownards Road, Belfast, BT4 3HE, is responsible for the personal information described in this notice. Questions and rights requests can be sent to sinead@rmerecruit.com.
Information RMErecruit may collect
Candidate information may include contact details, work history, qualifications, skills, salary and role preferences, interview notes, applications, consent records and documents you choose to provide. Employer information may include contact details, vacancy requirements, correspondence, terms acceptances, placement and invoice records.
Why it is used
RMErecruit uses personal information to respond to enquiries, assess and present candidates for agreed opportunities, manage applications and placements, provide mentoring and follow-up, meet legal obligations, establish or defend legal claims, and operate secure employer and candidate services.
Vacancy applications and general CV registrations are processed on legitimate interests: matching professionals with suitable opportunities and operating a secure recruitment service. RMErecruit has assessed the purpose, necessity and balance with candidates’ rights. You may object to this processing or request earlier erasure by contacting Sinead. The privacy acknowledgement on an application confirms that you have read this notice. It is not marketing consent or permission to publish a spotlight.
Other activities may rely on taking steps at your request before a contract, performing a contract, legal obligation or separate consent where appropriate. Please do not send identification documents, financial account details or sensitive information unless the recruitment team has explained why it is needed.
Sharing and processors
Candidate information is shared with an employer only for a relevant recruitment purpose and with the appropriate authority. RMErecruit uses DNA to operate its website, Google Firebase for application records and authentication, and private Firebase Storage in europe-west4 for recruitment CVs. Files enter quarantine, undergo document validation and are checked by a restricted ClamAV service on Google Cloud Run before becoming available to authorised staff. Failed or infected uploads are rejected and queued for removal. Browsers cannot read or write the storage bucket directly, and no public CV download links are issued.
Bunny.net remains the provider for website media and separately configured agreement artefacts, Resend delivers emails, and Stripe handles invoicing and payment. Candidate and staff notifications contain a secure website link, never a CV attachment. Providers process information under contractual and security controls.
Candidate spotlights
Public spotlights contain only curated, approved fields. They do not expose private candidate records, contact details or CVs. Each spotlight must have recorded publication authority and an expiry date, after which it is removed from public view unless renewed.
Security and international processing
RMErecruit uses access controls, multi-factor authentication for administrators, private storage, malware scanning, audit records and encryption in transit. Some providers may process data outside the UK. Where that happens, RMErecruit relies on the transfer safeguards made available by the relevant provider and required by data protection law.
Retention
RMErecruit retains recruitment CVs and related candidate personal records for no more than six calendar years from genuine candidate contact, such as your submission, a reply or a documented two-way conversation. Automated acknowledgements, page views and internal administrative edits do not restart that period. You may request earlier erasure. A longer period requires a recorded legal or contractual obligation and a review deadline.
Scheduled checks remove eligible CV bytes and related personal records, with access blocked while any failed deletion is retried. Accepted agreements and related commercial evidence retain their separate six-year period after the last related placement or invoice. Public spotlight permission and expiry are managed separately.
Your rights
Depending on the circumstances, you may ask for access, correction, erasure, restriction, objection or a portable copy of your information, and may withdraw consent where processing relies on consent. You may also complain to the Information Commissioner’s Office. RMErecruit may need to verify identity before acting on a request.
Cookies and updates
Necessary technology supports security and core functions. Optional analytics or advertising technology is loaded only after consent. This notice may be updated when services or legal requirements change.
Recruitment notice version: rme-recruitment-2026-10-11. For questions or rights requests, contact sinead@rmerecruit.com or 07581 236869.